Creates a single KeyManager for the entire container and then passes it into the NCA constructor, eliminating several unnecessary KeyManager reads.